FBI says BlackSuit ransomware gang has demanded over $500 million since 2022.

Summary

By the CyberWire staff

At a glance.

FBI says BlackSuit ransomware gang has demanded over $500 million since 2022.
AWS patches flaws that could lead to account takeovers.
Kimsuky targets South Korean universities.

FBI says BlackSuit ransomware gang has demanded over $500 million since 2022.

The US Federal Buraeu of Investigation (FBI) has released an updated advisory on the BlackSuit ransomware, noting that the group has demanded more than $500 million in ransoms since the group emerged in September 2022. The FBI confirmed that BlackSuit is a rebrand of the Royal ransomware, and BleepingComputer notes that Royal is believed to be a successor to the Conti ransomware operation. Most of the group's ransom demands have ranged between $1 million and $10 million, with the highest individual demand reaching $60 million.

The FBI states, "BlackSuit conducts data exfiltration and extortion prior to encryption and then publishes victim data to a leak site if a ransom is not paid. Phishing emails are among the most successful vectors for initial access by BlackSuit threat actors. After gaining access to victims’ networks, BlackSuit actors disable antivirus software and exfiltrate large amounts of data before ultimately deploying the ransomware and encrypting the systems."

Unlock Key Insights from the SANS Application & API Security Survey 2024

Discover how leading AppSec testing tools are securing today’s complex dev environments. The SANS report provides essential findings and expert recommendations on maximizing the impact of pentesting, DAST, SCA, and more. Streamline remediation with pre-validated findings and protect your expanding attack surface effectively.

AWS patches flaws that could lead to account takeovers.

AWS has patched several vulnerabilities that could allow account takeovers, SecurityWeek reports. The flaws were discovered and responsibly disclosed by researchers at Aqua Security, who outlined their findings at Black Hat yesterday. SecurityWeek explains, "The vulnerabilities were found in AWS services such as CloudFormation, Glue, EMR, SageMaker, ServiceCatalog and CodeStar. When creating these services for the first time in a new region, an S3 bucket with a specific name is automatically created. The name consists of the name of the service of the AWS account ID and the region’s name, which made the name of the bucket predictable." The researchers found that attackers could use a technique called "Bucket Monopoly" to create these S3 buckets in advance, then maintain a foothold within them when a targeted organization expanded to a new region.

AWS said in a statement, "AWS is aware of this research. We can confirm that we have fixed this issue, all services are operating as expected, and no customer action is required."

DMV Rising, D.C.’s Premier Conference for Cyber Execs.

The Washington, D.C. Maryland, and Virginia (DMV) region has established itself as a top-tier player in the global cyber industry. Join us on September 12, 2024 to celebrate the remarkable accomplishments of the DMV's cybersecurity community, connect with the brilliant minds shaping the future of the field, and experience firsthand why the DMV region is the beating heart of cyber innovation. Register now to secure your spot.

Kimsuky targets South Korean universities.

Researchers at Resilience warn that the North Korean threat actor Kimsuky is launching phishing attacks against South Korean universities, Infosecurity Magazine reports. The threat actor is targeting university staff, researchers, and professors with phishing pages that impersonate university login pages. The group also uses a custom tool to send spearphishing emails from compromised email accounts. The goal of the operation is likely cyberespionage.

Resilience recommends that organizations follow security best practices to thwart these attacks, including implementing multifactor authentication.

Notes.

Today's issue includes events affecting The Democratic People's Republic of Korea, the Republic of Korea, and the United States.

Attacks, Threats, and Vulnerabilities

Web-Connected Industrial Control Systems Vulnerable to Attack (Security Boulevard) Half of the 40,000 internet-connected industrial control systems (ICS) devices in the U.S., more than half of which are associated with building control and automation protocols, run low-level automation protocols found in wireless and consumer access networks, including those of Verizon and Comcast.

Hackers could spy on cell phone users by abusing 5G baseband flaws, researchers say (TechCrunch) Security researchers found a dozen vulnerabilities in 5G baseband chips found in phones made by Google, OPPO, OnePlus, Motorola, and Samsung.

Mule-as-a-Service Infrastructure Exposed (Netcraft) New Threat Intelligence confirms connections underpinning pig butchering and investment scams Much like companies in the legitimate economy, criminals also ...

Security Patches, Mitigations, and Software Updates

Aqua Security Discovers Critical Vulnerabilities in Six AWS Cloud Services (GlobeNewswire News Room) A new attack vector could allow unauthorized users to breach AWS accounts through malicious code embedded in S3 buckets; the vulnerabilities were promptly...

Marketplace

Trend Micro CEO Eva Chen Calls for Rebalancing of Security and Business Continuity in Black Hat USA AI Summit Keynote (Trend Micro | Newsroom) Chen cites recent security outages and the AI revolution as drivers for a new way of thinking DALLAS, Aug. 5, 2024 /PRNewswire/ -- Trend Micro Incorporated (TYO: 4704; TSE: 4704), a global...

Products, Services, and Solutions

Meet AI Goat: The First Open Source AI Security Learning Environment Based on the OWASP Top 10 ML Risks (Orca Security) Orca's AI Goat: the first open-source, hands-on AI security learning environment based on the OWASP top 10 ML risks.

MetaRouter and Zeotap Partner to Deliver an End-to-End, Europe-Centric Customer Data Solution That Puts Privacy and Security At the Forefront (PR Newswire) /PRNewswire/ -- We are thrilled to announce a new partnership between MetaRouter, the trailblazers in server-side tag management and real-time event routing,...

Trend Micro Expands Partnership Focus to Secure Enterprise AI Use (Trend Micro | Newsroom) Trend Micro Incorporated (TYO: 4704; TSE: 4704) continues to pioneer advancements in its cybersecurity platform to secure enterprise AI use. Aligned with this innovation focus, the company today...

Securonix and Cribl Form Strategic Partnership to Bolster Threat Detection Against AI-Powered Cyber Threats Through Expanded Data Ingestion Capabilities (BusinessWire) Strategic partnership enables organizations to leverage Cribl to ingest broader range of data into Securonix’s Gartner Magic Quadrant-leading SIEM for enhanced defense against AI-based cyber threats

Trend Micro Strengthens AI Deployments for Enterprises and Governments with NVIDIA AI Enterprise (Trend Micro | Newsroom) Trend Micro Incorporated (TYO: 4704; TSE: 4704) has launched multiple efforts to shape the future of AI implementation by enterprises and governments. The new solution, included in Trend Micro's...

Legislation, Policy, and Regulation

US elections have never been more secure, says CISA chief (The Register) Election tech is fine – it's all thise idiots buying into the propaganda that's worrying Jen Easterly

Litigation, Investigation, and Law Enforcement

Exclusive: Massive Criminal Online Platform Disrupted (Court Watch) The FBI hacked a large online hacker forum, arrested administrator in Florida

Industry Events

For a complete running list of events, please visit the Event Tracker.

Newly Noted Events

SOC Analyst Appreciation Day: Success Secrets from Security Leaders (Virtual, Oct 16, 2024) SOC analysts are too often overworked and underappreciated, leading to burnout and turnover. Devo established SOC Analyst Appreciation Day™ to pay some long-overdue kudos to SOC analysts and to encourage organizations to improve their job satisfaction and mental well-being.

Events

Unpacking the 2024 Ransomware Landscape: Insights and Strategies from ThreatLabz (Virtual, Aug 22, 2024) This live discussion on the latest findings from the Zscaler ThreatLabz 2024 Ransomware Report highlights the most targeted industries and regions, the dynamics behind a ransom payout, emerging ransomware families, and predictions for 2025. Register now.

SecureWorld Manufacturing & Retail Virtual Conference (Virtual, Aug 28, 2024) Join with cybersecurity professionals for training and information sharing through an interactive online experience. Earn 6 CPE credits learning from nationally recognized industry leaders. The agenda offers 12+ educational presentations, including panel discussions, breakout sessions, and keynotes. Connect with your peers in the Networking Lounge, enter to win prizes, and see demos and resources from top solution vendors in the Exhibitor Hall.

SANS Network Security Las Vegas 2024 (Las Vegas (and virtual), Nevada, USA, Sep 4 - 9, 2024) At SANS Network Security 2024, choose from 41 interactive courses with hands-on labs. Practice your skills and compete against your peers during NetWars Tournaments, and network with your instructor and industry colleagues in real-time. Each course includes electronic and printed books, and several courses align with GIAC certifications!

Jailbreak Brewing Company Security Summit (Laurel, Maryland, USA, Sep 6, 2024) Join some of the world's best security researchers as they talk about disinformation; the misleading and deliberate deception in today's connected world, both from the technical and policy sides at the only computer security event held at a production brewery. Attendance is limited to 150 to keep the Security Summit small and encourage conversation between speakers, attendees, and sponsors. Tickets include breakfast, lunch, and an awesome time to chat with fellow security experts. Come participate in the talks, the conversation, and the beer!

DMV Rising 2024 (Washington, DC, Sep 12, 2024) DMV Rising is D.C.'s premier cybersecurity event, bringing together cybersecurity executives to tackle tough problems, share new insights, and explore innovative solutions emerging in D.C., Maryland, and Virginia.

Sponsor & Support

Grow your brand, generate leads, and fill your funnel.

With the industry’s largest B2B podcast network, popular newsletters, and influential readers and listeners all over the world, companies trust the CyberWire to get the message out. Learn more.

Daily Briefing for 08.08.24

At a glance.

FBI says BlackSuit ransomware gang has demanded over $500 million since 2022.

AWS patches flaws that could lead to account takeovers.

Kimsuky targets South Korean universities.

Notes.

Attacks, Threats, and Vulnerabilities

Security Patches, Mitigations, and Software Updates

Marketplace

Products, Services, and Solutions

Legislation, Policy, and Regulation

Litigation, Investigation, and Law Enforcement

Newly Noted Events

Events